Privacy Policy
Last updated 17 October 2026
We are a family-run textile house. We collect only what we need to make, sell and deliver cloth to you, and to serve our trade partners. This policy explains what that is and what you can ask of us.
1. Who we are
This website is run by [registered business name], trading as Indo Fab, of [registered address], Punjab, India (GSTIN [GSTIN]). For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the Data Fiduciary for the personal data described here.
2. What we collect
| When | What |
|---|---|
| You browse the site | Device and browser type, pages viewed, approximate location from IP, essential cookies (cart, session). |
| You place a retail order | Name, email, phone, shipping and billing address, order history. Payment details are entered with our payment partner; we never see or store your full card or UPI credentials. |
| You create an account | Name, email, phone and a password (stored only as a secure hash). |
| You apply for or use a trade account | Business name, GSTIN, business address, contact person, phone, email, order and enquiry history, and the trade prices agreed with you. |
| You enquire on WhatsApp, phone or email | Your number or email, your messages, and the design codes you ask about. |
| You message us or interact with our Facebook, Instagram or YouTube | Your public profile name, what you send or comment, and which post it relates to. |
| An AI agent or app acts for you | The same order or enquiry data as above, plus request logs (time, endpoint, IP, user agent). See AI & API use. |
We do not collect sensitive data such as health, biometric or religious information, and we ask you not to send it to us.
3. Why we use it
- To process, ship and support your orders, returns and refunds.
- To run trade accounts: verify businesses, show trade pricing, raise invoices and follow up on enquiries.
- To meet legal duties, including GST invoicing, accounting and responding to lawful requests.
- To keep the site secure and prevent fraud or abuse, including automated abuse.
- To send updates on new collections, but only if you opt in. You can opt out at any time.
We process your data either with your consent, or for a "legitimate use" allowed by Section 7 of the DPDP Act, such as completing a purchase you asked for or meeting a legal obligation. Where we rely on consent you can withdraw it at any time; this does not affect processing already done.
4. Who we share it with
We never sell your personal data. We share it only with service providers who help us run the business, under contract and only for these purposes:
- Payment partner: [payment gateway, e.g. Razorpay]
- Courier and logistics partners, for delivery
- Hosting and infrastructure for this website and our commerce system
- Our AI model provider, [e.g. Anthropic], only for the agent tasks listed on our AI & API use page, and not for training its models
- Our accountants and auditors, and government authorities where the law requires it
Analytics, social and messaging apps
| Service | What we use it for | What it receives |
|---|---|---|
| Google Analytics Google LLC · only with your consent | Measuring visits, popular pages and how shoppers move through the site. | Pseudonymous device ID, pages viewed, approximate location, device and browser type. No name, email or phone. |
| Meta Pixel (Facebook and Instagram) Meta Platforms, Inc. · only with your consent | Measuring which Facebook and Instagram posts and ads bring visitors, and showing our ads to people who visited. | Pseudonymous device ID, pages viewed, products added to cart and purchase value. Hashed email or phone only if you opt in. |
| Facebook and Instagram pages Meta Platforms, Inc. | Posting collections and replying to comments and direct messages. | What you send us there, under Meta's own terms. We read messages to reply; we do not import your profile. |
| WhatsApp Business Meta Platforms, Inc. | Trade enquiries by design code, order and shipping updates, and customer support. | Your phone number, WhatsApp name, messages, and the order number or design codes involved. |
| YouTube Google LLC · only with your consent | Hosting our drape and craft films, embedded on product and story pages. | Embedded videos load in privacy-enhanced mode; YouTube sets cookies only when you press play. |
| [other tool] | [add every new analytics, marketing or automation tool here before it goes live] | [data it receives] |
Some providers may store data outside India. We only transfer data to countries not restricted by the Government of India under the DPDP Act, and with safeguards in place.
5. How long we keep it
- Order and invoice records: as long as tax and accounting law requires (currently up to 8 years).
- Account data: until you delete your account, then removed or anonymised, except what the law requires us to keep.
- Enquiry messages: up to [24] months after your last contact.
- Security and API request logs: up to [12] months.
6. Cookies
We use essential cookies to keep your cart and sign-in working; these are always on. Google Analytics, the Meta Pixel and YouTube video cookies are only set after you accept them in the cookie banner, and you can change your choice at any time from the "Cookie settings" link in the footer. Refusing them does not stop you shopping with us.
7. Your rights
Under the DPDP Act you can:
- ask for a summary of the personal data we hold about you and who we have shared it with;
- ask us to correct, complete, update or erase it;
- withdraw consent you have given;
- nominate someone to exercise these rights if you die or become incapacitated;
- raise a grievance with us, and then, if unresolved, with the Data Protection Board of India.
Write to our Grievance Officer (below). We may need to verify your identity before acting.
8. Children
Our site is meant for adults. We do not knowingly collect data from anyone under 18 without verifiable consent from a parent or guardian. If you think we have, contact us and we will delete it.
9. Security
We use encryption in transit, access controls and reputable providers to protect your data. No system is perfectly secure; if a breach affects you, we will tell you and the Data Protection Board as the law requires.
10. Grievance Officer
[Name], Grievance Officer, Indo Fab
[address] · [email] · [phone]
We acknowledge complaints within 48 hours and aim to resolve them within one month.
11. Changes
If we change this policy we will update the date above, and tell you directly if the change is significant.
See also our Terms & Conditions and AI & API use.